@datarails-ai/dr-cli 1.6.73 → 1.6.75

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.73",
+  "cliVersion": "1.6.75",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {
@@ -763,6 +763,30 @@
         }
       ]
     },
+    "odata tables": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "read"
+        }
+      ]
+    },
+    "odata metadata": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "read"
+        }
+      ]
+    },
+    "odata data": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "read"
+        }
+      ]
+    },
     "storyboards list": {
       "requires": [
         {

package/dist/skills/dr-cli/SKILL.md

@@ -23,7 +23,8 @@ for any command come from `dr <command> --help` (the binary is authoritative).
    `register-identity`, `bulk-create`, `bulk-set-email`, `bulk-permissions`,
    `set-email`, `set-email-notifications`, `bulk-set-email-notifications`,
    `set-password`, `set-field-type`) — on `US`, `US2`, `UK`, `CA`,
-   `EU`, `DEMO` (DEMO is a customer-facing prod tenant, not a sandbox) must be
+   `EU`, `STUDIO`, `DEMO` (DEMO is a customer-facing prod tenant, not a sandbox;
+   STUDIO is the free-tier environment and holds real prospects' data) must be
    confirmed by the user before you run them. `register-identity --confirm` in
    particular sends real invite emails to customers, so it counts as a prod
    write. Demonstrate on `DEV` / `DEV-1` / `TEST` / `TEST-1`..`TEST-7` first when
@@ -40,7 +41,7 @@ for any command come from `dr <command> --help` (the binary is authoritative).
    dialog (or TTY prompt) where the *user* types a fresh challenge word; in a
    headless shell it refuses non-zero. Don't add your own word ritual in chat.
    Non-prod (`DEV`/`DEV-1`/`TEST`/`TEST-1`..`TEST-7`) is token-only, a plain
-   "yes" suffices; `DEMO` counts as prod. Details in
+   "yes" suffices; `DEMO` and `STUDIO` count as prod. Details in
    [reference/safety.md](reference/safety.md).
 4. **Credentials are sensitive.** Sessions live in the OS keychain, or in a
    credential file where one is in use — never extract or echo JWTs or session
@@ -103,7 +104,7 @@ update it in the file alongside the key, or the warning keeps naming the old
 one.
 
 `--server <KEY>` is **required on every command that hits an API**. Valid keys:
-`US`, `US2`, `UK`, `CA`, `EU`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO` (case-insensitive).
+`US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO` (case-insensitive).
 
 You can also pass a full **`https://<host>.datarails.com` URL** instead of a
 key to reach an ad-hoc / PR-preview environment, e.g.
@@ -539,8 +540,8 @@ returns the source rows behind the number.
 counts — and a token; re-run with `--confirm-token` to fire it) → poll `scans
 status` again. This is a **full historical** rescan (every calc field × every
 version). To only pick up a datamapper change on the live template, prefer
-`datamappers update <id> --rescan latest` (latest version only; mirrors "Publish
-and scan") — far cheaper and lower-blast.
+`datamappers update <id> --rescan latest` (latest version of the mapper's bound
+documents only) — far cheaper and lower-blast.
 
 **Build a `create` body from plain-English intent** (calc models, datamappers,
 metrics): you resolve names → integer IDs yourself against the tenant

package/dist/skills/dr-cli/reference/datamappers.md

@@ -67,6 +67,12 @@ value-inference behavior. `NAME` is the target **table field** name (the
 ## Update / preview / bind / delete
 
 - `datamappers update`, `datamappers delete` (two-step confirm).
+- `datamappers update --rescan latest` — after the PUT, dr watches the
+  template's scan status for up to 30s, because servers without the DR-54200 fix
+  save the config but ignore `rescan: "latest"`. If no new scan shows up, it
+  prints a warning with a ready `datamappers bind <id> --doc … --rescan latest`
+  command. Run `scans status <template_id>` first: the scan may only be queued,
+  and `bind` on a queued scan starts a second one. Don't re-run `update`.
 - `datamappers preview --payload-file <p>` — renders mapper output for sample
   input ("what would this extract?") before saving.
 - `datamappers bind <mapper_id> --doc <id> [--rescan latest|all]` — change which

package/dist/skills/dr-cli/reference/multi-product.md

@@ -117,7 +117,7 @@ org 99.
 
 Token TTL is 10 minutes — past that, re-run step 1.
 
-For prod (`US`/`US2`/`UK`/`CA`/`EU`/`DEMO`), get the user's in-chat "yes" before
+For prod (`US`/`US2`/`UK`/`CA`/`EU`/`STUDIO`/`DEMO`), get the user's in-chat "yes" before
 re-invoking with the token; the binary's interactive gate then has the user
 type a challenge word in a dialog, same as any other destructive write — see
 [safety.md](safety.md).

package/dist/skills/dr-cli/reference/safety.md

@@ -38,7 +38,8 @@ Reads never need confirmation. Gated **writes** fall into two tiers (full table:
 `src/commands/_prodGateTiers.ts`):
 
 - **Tier A — destructive / irreversible / org-wide.** On a prod tenant (`US`,
-  `US2`, `UK`, `CA`, `EU`, `DEMO` — DEMO is customer-facing) the binary requires a
+  `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEMO` — DEMO is customer-facing, STUDIO holds
+  real prospects' data) the binary requires a
   live human to type a fresh challenge word in a desktop dialog / TTY (see
   "Binary-enforced interactive gate" below). Relay the plan output (target name
   + blast radius), get a clear in-chat "yes, do it", then re-invoke with
@@ -105,7 +106,7 @@ the LUT that 4 functions depend on" — before running.
 
 The human check is enforced **in the binary** — not by prose an agent could
 skip or forget. When a valid `--confirm-token` is redeemed for a **Tier-A**
-action against a prod tenant (`US`, `US2`, `UK`, `CA`, `EU`, `DEMO` — plus,
+action against a prod tenant (`US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEMO` — plus,
 fail-closed, any server the CLI cannot positively classify as non-prod, and any
 action not positively classified as Tier B), the binary requires a live human:
 

package/dist/skills/dr-cli/reference/templates.md

@@ -150,7 +150,7 @@ except on `update`, which resolves the range's own table automatically.
   `--confirm-token` — token-only, no word gate even on prod (a rescan re-derives
   data, it doesn't delete it). To pick up a datamapper change on the live template
   **without** touching history, use `datamappers update <id> --rescan latest`
-  instead (mirrors the UI "Publish and scan"); a full rescan will re-run pre-existing
+  instead (re-extracts the latest version of the mapper's bound documents); a full rescan will re-run pre-existing
   calc fields against old rows, so a latent divide-by-null there fails the whole
   scan. Refuses `UsageStats` on every tenant (system data, not customer-owned).
 - `dataflow get` — the dependency graph: inputs → mappers → LUTs → table →

package/dist/skills/dr-error-enrichment/SKILL.md

@@ -67,7 +67,7 @@ These hold in every sub-skill; the detail is in
 [reference/safety-backup.md](reference/safety-backup.md).
 
 1. **Confirm the target server explicitly** — ask, never infer it from earlier
-   conversation. `US`, `US2`, `UK`, `CA`, `EU`, `DEMO` are all prod.
+   conversation. `US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEMO` are all prod.
 2. **Back up every reachable server before the first write** of a session, not
    just the target — the export is also the diff baseline. One command:
    `dr error-enrichments export --all-servers --out <dir>`. Tell the user the

package/dist/skills/dr-error-enrichment/reference/groundcover.md

@@ -64,9 +64,10 @@ Groundcover envs are not dr-cli server keys. Envs are `prod-us`, `prod-east-us`,
 | `DEMO` | `prod-demo` |
 | `US` / `US2` | **ambiguous** across `prod-us`, `prod-east-us`, `prod-west-us-2` |
 | `EU` | **unmapped** — resolve it before mining (see below) |
+| `STUDIO` | **unmapped** — resolve it before mining (see below) |
 
-`EU` was added to the registry after this table was written and its
-groundcover env has not been confirmed. Resolve it the same way as the US
+`EU` and `STUDIO` were added to the registry after this table was written and
+their groundcover envs have not been confirmed. Resolve them the same way as the US
 ambiguity before mining, and record the answer here once known.
 
 Resolve the US ambiguity with

package/dist/skills/dr-error-enrichment/reference/safety-backup.md

@@ -9,8 +9,8 @@ reading.
 
 **1. Confirm the target server explicitly.** Ask (AskUserQuestion) which server
 to change — never infer it from earlier context in the conversation. Prod keys
-are `US`, `US2`, `UK`, `CA`, `EU`, `DEMO` (DEMO is customer-facing prod, not a
-sandbox). Demonstrate on `DEV` / `TEST-*` first when the user is undecided.
+are `US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEMO` (DEMO is customer-facing prod, not a
+sandbox; STUDIO is the free-tier environment and holds real prospects' data). Demonstrate on `DEV` / `TEST-*` first when the user is undecided.
 
 **2. Back up every reachable server first.** Before the first write of a
 session, one command — `export` takes the same sweep flags as `list` / `stats`,

package/dist/skills/dr-error-enrichment-improve/SKILL.md

@@ -44,7 +44,7 @@ fixing disliked rules is `dr-error-enrichment-maintain`.
 **1. Pick the region and the window, and prove they line up.** Ask which server
 the user intends to improve, then map it to the groundcover env before querying —
 `UK` is `prod-uk*`, `CA` is `prod-canada-central`, `DEMO` is `prod-demo`, and
-`US`/`US2` are ambiguous across the three US envs and `EU` is not mapped at
+`US`/`US2` are ambiguous across the three US envs and `EU` and `STUDIO` are not mapped at
 all, so resolve those explicitly (see the reference). Mining one region's logs to justify a rule you then write to
 another is the failure mode this step exists to prevent. Start with a tight
 window and widen only after it returns rows.

package/dist/skills/dr-filebox-api-setup/SKILL.md

@@ -23,7 +23,7 @@ Before issuing any commands, confirm the following with the user if not already
 | Input | How to resolve |
 |---|---|
 | **Target fileboxes** | IDs/names, or a folder name to expand — run `dr filebox list --server <S>` and filter by parent folder ID |
-| **Server** | Ask if not obvious from context (`US`, `US2`, `UK`, `CA`, `EU`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO`) |
+| **Server** | Ask if not obvious from context (`US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO`) |
 | **Connection** | Run `dr integrations list --server <S>` and show the WorkatoBased options; ask the user to pick |
 | **Object type** | Ask — commonly `table`; surface the value from a reference filebox if one exists |
 | **Start date / End date** | Ask — commonly "start of month" / "end of month", which maps to `{{date_tag|somonth}}` / `{{date_tag|eomonth}}` |
@@ -69,7 +69,7 @@ If no reference exists, build the payload from the gathered inputs (see Step 4).
 
 ## Step 3 — Enable Upload via API on all target fileboxes
 
-Run in parallel for efficiency. This is a prod write — confirm with the user before running on `US`, `US2`, `UK`, `CA`, `EU`, `DEMO`.
+Run in parallel for efficiency. This is a prod write — confirm with the user before running on `US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEMO`.
 
 ```bash
 dr documents support-api set <id1> --on --server <S> &
@@ -152,7 +152,7 @@ Offer to export the table as a CSV if the user wants it.
 
 ## Guard rails
 
-- **Prod confirmation required.** `support_api` and `data-query set` are writes. On `US`, `US2`, `UK`, `CA`, `EU`, `DEMO`, confirm in-chat before running.
+- **Prod confirmation required.** `support_api` and `data-query set` are writes. On `US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEMO`, confirm in-chat before running.
 - **Never read out tokens or JWTs.** The UUID returned is not a secret, but session tokens are — do not surface them.
 - **Always verify the integration ID from `dr integrations list`** — do not guess or reuse IDs from a prior session without confirming they match the current tenant.
 - **Always quote file paths** in `--payload-file` on Windows to handle spaces in directory names.

package/dist/skills/dr-switch-user/SKILL.md

@@ -53,7 +53,7 @@ The skill is invoked in one of these forms:
 
 ## Server keys (the universe to probe)
 
-`US`, `US2`, `UK`, `CA`, `EU`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO` — case-insensitive.
+`US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO` — case-insensitive.
 These are the only valid `--server` values dr-cli accepts.
 
 ---
@@ -82,7 +82,7 @@ across all servers wastes turns and can scope the default wrongly.
 Print verbatim, then wait for the user's reply. Do not guess from
 context, prior turns, or `userEmail`:
 
-> Which server should I switch to `<email>` on? (`US`, `US2`, `UK`, `CA`, `EU`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO`)
+> Which server should I switch to `<email>` on? (`US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO`)
 
 ### 2.2. Probe that one server
 
@@ -226,7 +226,7 @@ Use the **single-loop pattern** (same reason as Section 2 — parallel
 tool calls cancel each other on the first non-zero exit):
 
 ```bash
-for srv in US US2 UK CA EU DEV DEV-1 TEST TEST-1 TEST-2 TEST-3 TEST-4 TEST-5 TEST-6 TEST-7 DEMO; do
+for srv in US US2 UK CA EU STUDIO DEV DEV-1 TEST TEST-1 TEST-2 TEST-3 TEST-4 TEST-5 TEST-6 TEST-7 DEMO; do
   echo "=== $srv ==="
   dr whoami --server "$srv" 2>&1 || true
 done

package/dist/skills/fx-conversion-matrix/SKILL.md

@@ -728,7 +728,7 @@ the package layout reaches every producer.
 
 - **Every write here is prod-tier.** Functions, filebox, mappers, lookups and custom
   currencies are all mutations. Confirm before running on `US`, `US2`, `UK`, `CA`,
-  `EU` — **and on `DEMO`**, which is a customer-facing demo tenant, not a sandbox.
+  `EU`, `STUDIO` — **and on `DEMO`**, which is a customer-facing demo tenant, not a sandbox.
   Prefer a `DEV`/`TEST*` rehearsal when the org is unstated.
 - **Never guess a currency, a base, or a missing pair.** Each is a question for the
   customer. A wrong rate mislabels real money and nobody downstream can tell.

package/dist/skills/mec-table-validation/SKILL.md

@@ -38,8 +38,8 @@ config before the operator wastes time debugging downstream symptoms.
 
 ## Inputs
 
-- `--server <key>` — required. Valid: `US`, `US2`, `UK`, `CA`, `EU`, `DEV`,
-  `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`,
+- `--server <key>` — required. Valid: `US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`,
+  `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`,
   `TEST-6`, `TEST-7`, `DEMO` (case-insensitive). Default per project
   convention: `US`.
 - `--report` — optional. Writes a markdown report to cwd in addition to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.73",
+  "version": "1.6.75",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {
@@ -17,10 +17,11 @@
     "access": "public"
   },
   "dependencies": {
-    "@datarails-ai/dr-appspace-cli": "0.9.5",
+    "@datarails-ai/dr-appspace-cli": "0.9.7",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^12.1.0",
+    "fast-xml-parser": "^5.11.2",
     "jszip": "^3.10.1",
     "node-html-parser": "^6.1.13",
     "open": "^10.1.0",